Over a billion Android phones vulnerable to phishing attack

Over a billion Android smartphones, including those from the world’s largest manufacturers, are vulnerable to a hugely dangerous cyberattack, researchers have warned.

A new report from Check Point Research has uncovered a security flaw that could leave users open to advanced phishing attacks that would steal personal information.

The company says that hundreds of millions of Android phones across the world are at risk from the attack, with devices from Samsung, Huawei, LG and Sony among those affected.

Counterfeit

The flaw allowed hackers to steal user email addresses using counterfeit Android SMS messages that have been custom-engineered to intercept all email traffic to and from mobiles.

The affected Android phones use over-the-air (OTA) provisioning, which allows mobile network operators to deploy network-specific settings to a new phone joining their network.

In this case, the SMS is disguised as an innocent ‘update network settings’ text from the mobile network provider.

The researchers say that anyone connected to a cellular network can be targeted by such attacks, as the SMS doesn’t require a victim’s device to be connected to a Wi-Fi network, and it only takes a single message to gain full access to a device’s emails.

Samsung phones were found to be the most at risk to the attack as they do not have an authenticity check. The user only needs to accept the message for the malicious software to be installed without the sender needing to prove their identity.

“Given the popularity of Android devices, this is a critical vulnerability that must be addressed,” said Slava Makkaveev, security researcher at Check Point Software Technologies.

“Without a stronger form of authentication, it is easy for a malicious agent to launch a phishing attack through over-the-air provisioning. ”

Check Point says the flaw was first detected in March 2019, and the company told the affected manufacturers soon after.

So far, Samsung and LG have released fixes, with Huawei set to launch its patch in the next generation of Mate and P-series smartphones – with Sony insisting its devices are already up to scratch.

Source: TechRadar